Passing a security check does not make a payment authorized. The EBA and ECB note that an authenticated transaction "cannot automatically be assumed to also have been authorised" (2025 Report on Payment Fraud, p. 20). The EUR 4.2 billion of fraudulent payments they count across the EEA in 2024 (p. 10) holds both: payments criminals issued themselves and payments that manipulated payers sent (p. 6).
Which payments count as transaction fraud?
Among the fraud types in what fraud is, transaction fraud is defined by consent, whatever the channel. In most card payment fraud in the EEA, "fraudsters directly issued the payment order" (EBA and ECB, p. 6). UK Finance counts card, cheque and remote banking fraud as unauthorized fraud (Annual Fraud Report 2026, p. 20).
Table 1. Five forms of transaction fraud: the channel, who gave the instruction, what the holder sees and the control.
| Form | Channel | Who gave the instruction | What the holder sees | Control |
|---|---|---|---|---|
| Stolen card details used online | Card not present | A criminal with the card data | A purchase they never made | Strong authentication at checkout |
| Skimmed or counterfeit card | ATM or card terminal | A criminal with a copied card | Withdrawals or purchases elsewhere | EMV chip, skimmer checks |
| Lost or stolen card | Card present, contactless | Whoever holds the card | Small payments after the loss | Prompt report, card blocked |
| Account takeover transfer | Online or mobile banking | A criminal logged in as the holder | A transfer to an unknown payee | New device and new payee checks |
| Unauthorized ACH debit | ACH network | A company debiting without consent | A debit from an unknown company | Statement review within 60 days |
What is transaction fraud?
The fraud hub's types table lists transaction fraud as "A payment the account holder did not authorize", with cardholders and merchants as typical victims. It is also called transactional fraud (fraude transaccional in Spanish, fraude transacional in Portuguese).
UK Finance says that in an unauthorized fraudulent transaction, "the account holder themselves does not provide authorisation for the payment to proceed" (p. 12). Regulation E covers a transfer "initiated by a person other than the consumer without actual authority" that brings the consumer no benefit, on consumer accounts only (12 CFR 1005.2).
PSD2 is shorter: "In the absence of consent, a payment transaction shall be considered to be unauthorised" (Article 64(2)). In the UK, regulation 67 makes consent the test as well.
Ufuk Gürdaş, the entry's reviewer: "A transaction is fraudulent because of who gave the instruction, not how big it is, so the first question on every alert is whether the account holder authorized it; that splits a stolen card or a taken over account from a push payment the customer was tricked into sending."
What are the types of transaction fraud?
- Card fraud. A stolen, lost or copied card, as in credit card fraud.
- Card not present fraud. Stolen card details used remotely, as in card not present fraud.
- Account takeover. A login with stolen credentials, then a transfer, as in account takeover fraud.
- ACH debits. A debit without authorization, one form of ACH fraud.
- Online transaction fraud. Stolen details used on ecommerce sites and apps, as in ecommerce fraud.
Identity theft and synthetic identities are enablers: they open or take over the account. Chargeback fraud is the mirror case: the holder authorized the payment, then disputes it, and Regulation E excludes transfers made "with fraudulent intent by the consumer".
Who repays an unauthorized payment in the US, UK and EU?
Table 2. Who repays an unauthorized payment: the rule, what it covers, the refund duty and the holder's maximum or the prison term, by jurisdiction.
| Jurisdiction | Rule | Covers | Refund duty | Holder's maximum or prison term |
|---|---|---|---|---|
| US | Regulation E, 12 CFR 1005.6(b) and 1005.11(c) | Consumer accounts only | Investigate: a decision within 10 business days, or provisional credit and up to 45 days (longer in some cases) | At most $50 if told within two business days of learning a card or code was lost or stolen; at most $500 after that; later transfers can fall on the holder if a statement goes unreported for 60 days |
| US | Regulation Z, 12 CFR 1026.12(b) | Credit cards (an issuer and an organization with 10 or more employee cards may agree otherwise) | Not set in this section | The lesser of $50 or the amount used before notice |
| US | 18 U.S.C. 1029 | Crime: "knowingly and with intent to defraud" using or trafficking in unauthorized access devices to obtain $1,000 or more in a year ((a)(2)), or transacting with devices issued to another person to receive $1,000 or more in a year ((a)(5)) | None (criminal law) | A fine, up to 10 years for (a)(2) or 15 for (a)(5), or both, on a first conviction under the section |
| UK | Payment Services Regulations 2017, regulation 76 and regulation 77 | Payment transactions | By the end of the business day after the provider becomes aware, unless it has reasonable grounds to suspect the user's fraud and tells a person listed in section 333A(2) of the Proceeds of Crime Act 2002 in writing | Up to £35 for a lost, stolen or misappropriated instrument; all losses for fraud, or for breaching security duties with intent or gross negligence; nothing, unless the payer acted fraudulently, if required SCA was not applied or the instrument was used for a distance contract other than an excepted one |
| England, Wales and Northern Ireland | Fraud Act 2006, section 2 | Crime: a person "dishonestly makes a false representation" that they know is or might be untrue or misleading, intending a gain, a loss or a risk of loss; s2(5) includes "any system or device" | None (criminal law) | On indictment, up to 10 years, a fine or both (section 1(3)) |
| Scotland | Common law fraud (Scottish Government) | Crime | None (criminal law) | The source lists the offense, not a penalty |
| EU | PSD2, Articles 73 and 74 | Payment transactions | Immediately, and by the end of the following business day at the latest, unless the provider has reasonable grounds to suspect fraud and reports them in writing to the national authority | Up to EUR 50 for a lost, stolen or misappropriated instrument; all losses for fraud, or for breaching security duties with intent or gross negligence; nothing without SCA unless the payer acted fraudulently |
Larger businesses get less. In the UK, a business that is not a consumer, microenterprise or charity may agree with its bank that regulation 77 does not apply (regulation 63(5)). PSD2 lets a non consumer set aside Article 74, though member states may protect microenterprises as consumers (Article 61(1) and (3)). Neither rule lets the bank drop its refund duty. The Fraud Act's offenses extend to England, Wales and Northern Ireland only (section 15).
How does a fraudulent transaction happen, step by step?
The CFPB gives this case (Regulation E FAQs, Unauthorized EFTs question 5, updated 4 June 2021): a caller "pretending to be a representative from the consumer's financial institution" gets the login, a "texted account confirmation code" or the debit card number. The Bureau counts that transfer as unauthorized.
- Details taken. A call, a phishing page, a skimmer or a breach.
- Tested. A small payment checks that the details work.
- Spent or moved. Purchases, or a transfer to an account the criminal controls.
- Cashed out. Goods resold, money passed on.
- Disputed. The holder reports it to the bank and, in England, Wales and Northern Ireland, to Report Fraud; in Scotland, reports go via 101.
Which techniques do fraudsters use to get payment details?
- Phishing and social engineering. Messages, fake pages or calls that get the details from the holder, as in phishing.
- Skimming and cloning. A device at an ATM or terminal copies the card for a counterfeit.
- Man in the middle (MITM). Someone between customer and bank reads or alters the traffic.
- Malware. Software on the device records logins.
- Data breaches. Stolen card files, as in the fraud hub's example of a card used after a data breach.
What is the impact of transaction fraud on businesses and consumers?
UK Finance counted £703.4 million of gross unauthorized fraud losses in 2025, down 5 percent, across 3,814,128 confirmed cases "where a loss has occurred"; £594.9 million of it was on cards (pp. 13 and 20).
Understanding who pays starts with the instrument. In the EEA in 2024, users bore 38 percent of card fraud losses but around 85 percent of credit transfer losses, "possibly" because liability regimes and redress differ, among other reasons (EBA and ECB, p. 7). Reporting payment providers bore EUR 829 million (p. 34).
Which red flags identify an unauthorized payment?
- A new device or location at login. A possible account takeover.
- Contact details changed just before a payment. Alerts now reach the criminal.
- A new payee, then a large transfer. Money leaves before the holder reacts.
- Several small declined payments. Card details being tested.
- Spending faster than the holder's history. Velocity.
- Billing and delivery addresses that differ. A card not present sign.
Transaction fraud vs APP fraud vs transaction laundering: what is the difference?
The PSR draws the line with a card: "APP fraud is different to unauthorised fraud, when someone steals your card to make payments, for example" (PSR).
In APP fraud the victim sends the money; in transaction laundering the cardholder's payment is real but the business behind the merchant is hidden.
Table 3. Transaction fraud, APP fraud and transaction laundering compared.
| Transaction fraud | APP fraud | Transaction laundering | |
|---|---|---|---|
| Who gives the instruction | A criminal | The victim, deceived | The cardholder, for a real purchase |
| Consent | None | Given under deception | Given |
| Example | A stolen card used online | Money sent to a fraudster posing as a genuine payee | A hidden business taking card payments through an approved merchant's account |
| UK refund route | Payment Services Regulations 2017, regulation 76 | PSR reimbursement for payments from 7 October 2024: individuals, microenterprises and charities, UK to UK transfers by Faster Payments or CHAPS, up to £85,000; not if the victim was complicit or grossly negligent (the gross negligence exception does not apply to vulnerable consumers) | Not a refund case for the cardholder |
| Signal | New device, unknown payee | A first payment to a new payee, under time pressure | Sales that do not fit the merchant's category |
Detecting and preventing transaction fraud: which tools and techniques work?
- Real time rules. Amount, velocity, payee and device conditions score each payment before it clears; a first transfer to a new payee minutes after a login from a new phone can be held.
- ML and AI scoring. Models trained on confirmed fraud rank payments by risk, and an analyst decides each case sent to review.
- Behavioral and device signals. Session and device history show who is paying.
- MFA and SCA. In the EEA in 2024, card payments with SCA generally had lower fraud rates than those without. Credit transfers with SCA had higher ones, likely because SCA is typically applied to riskier or larger payments (EBA and ECB, p. 6).
complead, formerly Sanction Scanner, scores a customer once: its fraud checks and its onboarding, screening, monitoring and investigation sit on one engine. At authorization, payment fraud detection returns approve, decline, review or escalate, with the reason.
On a disputed payment, the analyst first records who gave the instruction: a criminal with the holder's card or login points to the refund rules in Table 2, a deceived holder to the APP route in Table 3.
Related terms
- Unauthorized electronic fund transfer. Regulation E's term for a consumer transfer without actual authority.
- Strong customer authentication. PSD2's check on two or more independent elements.
- Chargeback fraud. Disputing a payment the holder authorized.
